Forum Discussion
OneDrive desktop client continues to experience authentication problems
We're currently investigating a widespread OneDrive desktop client authentication issue affecting many users.
Initially, users experienced continuous login prompt loops. In cases where authentication succeeded, OneDrive would repeatedly connect and disconnect, asking users to re-enter their credentials multiple times.
We've already attempted:
- Resetting OneDrive
- Uninstalling and reinstalling the client
- Removing and recreating Windows Credential Manager entries
- Signing users out and back into Microsoft 365
None of these steps resolved the issue.
A key finding is that OneDrive Online (browser access) works normally while connected to the corporate network. Users can access their files through the web without issue.
However, the OneDrive desktop client continues to experience authentication problems.
Today we identified an interesting workaround: when users connect through an external network (such as a mobile hotspot), OneDrive immediately authenticates and syncs successfully. Once we go back on the corporate network and reset OneDrive, the issue returns.
No firewall, VPN, or known network configuration changes have been made, and current reviews have not shown any obvious blocked traffic.
Given that:
- OneDrive Online works internally
- The desktop client fails internally
- The desktop client works externally (hotspot)
We're trying to determine what network, authentication, proxy, DNS, SSL inspection, Conditional Access, or Microsoft 365 endpoint-related issue could be impacting the OneDrive desktop client specifically.
Has anyone encountered similar behavior or have recommendations on where to investigate next?
1 Reply
The corporate-network versus hotspot result is your strongest diagnostic clue: the same desktop client can authenticate and sync elsewhere, so another reinstall is unlikely to isolate the problem. Browser access succeeding does not rule out a network issue affecting the desktop client's authentication or service endpoints. Reproduce one failure and one success with the same user and device, recording both timestamps. Have the identity administrator compare Entra sign-in results, target resources, client details, source IP addresses, and Conditional Access outcomes. In parallel, ask the network team to compare proxy configuration, DNS resolution, TLS inspection, and access to Microsoft's current Microsoft 365 endpoints. Do not assume that no intentional firewall change means the entire path is unchanged. If needed, test a narrowly scoped, administrator-approved network exception rather than disabling inspection company-wide. Continue using the working web client while the teams review redacted logs and network evidence.
